We use cookies to try and give you a better experience in Freshdesk.
You can learn more about what kind of cookies we use, why, and how from our Privacy policy. If you hate cookies, or are just on a diet, you can disable them altogether too. Just note that the Freshdesk service is pretty big on some cookies (we love the choco-chip ones), and some portions of Freshdesk may not work properly if you disable cookies.
We’ll also assume you agree to the way we use cookies and are ok with it as described in our Privacy policy, unless you choose to disable them altogether through your browser.
I would love to have threshold for fist event until a specific daily time.
Lets say for exemplo i want the fist event X to be notifield, then the threshold resets at 17:00 daily, ultil the rest time i do not receive any more alerts.
0 Votes
2 Comments
Heitor Rossi Machado posted about 4 years ago
Hi Ingmar,
Due to recent information security exigences, we need to raise alerts whenever an elevated account is used, althoug in our company we have a few users which have elevated access and are used normally.
So we have created an event alert over auditing event 4624 to send a MS-Teams message to specific group whenever one of those accounts login.
This event, raises too much alerts, so we have placed a thereshold with username/ip/logintype to avoid to much alerts, but it would be quite nice if those alerts reset at especific times.
Maybe there is a better way of doing this, but i dont know yet. This was the best i have found.
Ultimatelly, what we need is to detect any possible "anamolous usage" of privileged accounts "real time" and also register for later analisys, this way info-sec will be happy (since there is no way to request two factor for local ad logins)
0 Votes
Ingmar Koecher posted about 4 years ago Admin
Hola Heitor,
You are correct, thresholds start whenever the first event is logged, and this not currently a way to reset them at a specific time.
May I ask what you are ultimately trying to achieve with this setup? There may be a work-around using filter timers in EventSentry. If you can tell us exactly what you are trying to achieve then we can hopefully come up with a way to do this without adding additional functionality.
Saludos,
Ingmar.
0 Votes
Login or Sign up to post a comment